NSA can decrypt VPNs?

[stim]

Hi,

Amongst today's revelations about NSA's data collection activities is the suggestion that VPNs can be decrypted at will.
See slide #17

Not being an expert in this stuff, can anyone explain how this could be possible?

If it was do-able in 2008, how far have they advanced since then?

Cheeeers.

 

[concerto49]

Well anything can be brute forced provided you have enough money. When you have data centers and supercomputers for mass processing it does wonders.


Encryption is just so no one can in a reasonable time for reasonable cost.

 

[D. Strout]

Encryption is just so no one can in a reasonable time for reasonable cost.

...But of course the NSA isn't reasonable.

 

[stim]

Well anything can be brute forced provided you have enough money. When you have data centers and supercomputers for mass processing it does wonders.


Encryption is just so no one can in a reasonable time for reasonable cost.

The slide suggests that all VPNs in country X can be decrypted and the users identified.

This means that decrypting one VPN is a trivial task.

No?

 

[wlanboy]

A lot of users are still using pptp - so I think NSA does not have a lot of money to get access to these "vpn" connections.

 

[acd]

Here's a quotation from the referenced slide:

• Show me all the VPN startups in country X, and give me the data so I can decrypt and discover the usersThese events are easily browsable in XKEYSCORENo strong-selector

[*]XKEYSCORE extracts and stores authoring information for many major document types -- can perform a retrospective survey to trace the document origin since metadata is typically kept for up to 30 days
[*]No other system performs this on raw unselected bulk traffic, data volumes prohibit forwarding

Emphasis mine. Yes, they can decrypt the data, but it still costs processing time and it is probably not realtime. Worried? Use bigger SSL keys for authentication and stronger encryption. I'm sure 2048 bit RSA keys from a private CA and AES256 + SHA256-HMAC is going to be reasonably hard to a. forge and b. decrypt, but of course, this is a government agency with a metric *#&#-load of money; if they try hard enough, it doesn't matter. The point is they don't care about people who aren't persons of interest.

 

[jarland]

http://quotes.liberty-tree.ca/quote_blog/Thomas.Jefferson.Quote.EFEC


Relevant.

 

[KuJoe]

Best of all, your secret: nothing extant could extract it. 

By 2025 a children’s Speak & Spell could crack it. 

 

You can’t hide secrets from the future with math. 

You can try, but I bet that in the future they laugh 

at the half-assed schemes and algorithms amassed 

to enforce cryptographs in the past. 

 

[Slownode]

Best of all, your secret: nothing extant could extract it. 


By 2025 a children’s Speak & Spell could crack it. 


 


You can’t hide secrets from the future with math. 


You can try, but I bet that in the future they laugh 


at the half-assed schemes and algorithms amassed 


to enforce cryptographs in the past. 

If you use non-standard encryption all of a sudden noone can crack you with stock tools until they find out how you're doing it.
Something as simple as interlaced NOTing can throw off brute forcers.

 

[bfj]

By 2025 a children’s Speak & Spell could crack it. 

 

But the world ends in December of 2012. What kind of nonsense is this "future" and "2025"

 

[KuJoe]

They got alien technology to make the rainbow tables with,

then in an afternoon of glancing at ‘em, secrets don’t resist

the loving coax of the mathematical calculation,

heart of your mystery sent free-fall into palpitations.

Computron will rise up in the dawn, a free agent.

Nobody knows the future now; gonna find out — be patient.

 

[Damian]

 

[wdq]

I wonder if they have a supercomputer hidden in here, behind all of the hard drives, to decrypt encrypted traffic. 

 

[MannDude]

I wonder if they have a supercomputer hidden in here, behind all of the hard drives, to decrypt encrypted traffic. 

They sure have a shit-ton of water going to to it (1.7 million gallons per day), when other properties in the area are already struggling due to drought like conditions.

Best case scenario is an earthquake that interrupts the flow of water, no electricity, backup generators don't work as well as intended, everything overheats and melts.

I read somewhere that the entire facility will only have 200 people working there. That's over 4,000 sq/ft per employee, assuming they all work the same shift (which is unlikely), so that number increases dramatically.

 

[tonysala87]

If you're talking about a vpn for internet access, like privateinternetaccess.com then they don't need to decrypt that because your traffic enters the internet unencrypted from the vpn server.

As for VPN over the internet connecting two private networks, I have no idea if they can decrypt it, but my guess is yes.

 

[Slownode]

If you're talking about a vpn for internet access, like privateinternetaccess.com then they don't need to decrypt that because your traffic enters the internet unencrypted from the vpn server.


 


As for VPN over the internet connecting two private networks, I have no idea if they can decrypt it, but my guess is yes.

Well several major cert authorities are intercepted so HTTPS traffic can be spied upon with triangle spying.

 

[concerto49]

Well several major cert authorities are intercepted so HTTPS traffic can be spied upon with triangle spying.

Forget the certs. They HAVE the private key etc to the cert.

 

[Slownode]

Forget the certs. They HAVE the private key etc to the cert.

Client specific encryption keys never felt better.

 

[Enterprisevpssolutions]

I wonder if people remember where the internet started? I'm sure the Gov has the tech to decrypt what they want. If a programmer can use the nvidia or amd video GPUS to bruteforce something what do you think a supercomputer with millions of processors can do? http://hackaday.com/2012/12/06/25-gpus-brute-force-348-billion-hashes-per-second-to-crack-your-passwords/  the only issue occurs when you are selling a vps service that has many clients using the same vpn then you have more ips and more clients you have to look at and get warrents for but its still possible. Data forensics is some scary stuff and i played with some of that software I would love to play around with a few million processors running in parallel =D

 

[blergh]

Let's leave the internet!